valkyrjaio / valkyrja-java / 30416230156

100%

push

github

[CI] Declare the SpotBugs and JaCoCo tool versions as dependencies (#65)

# Description

The Java `Update Dependencies` automation reported
`com.github.spotbugs:spotbugs`
and `org.jacoco:org.jacoco.{agent,ant}` as outdated on every run, yet
never
updated them — SpotBugs sat on 4.9.8 and JaCoCo on 0.8.14 indefinitely.

`useLatestVersions` rewrites **dependency notations**. It cannot rewrite
a version
carried by a plugin extension, so `spotbugs { toolVersion.set("4.9.8")
}` and
JaCoCo's implicit plugin default were invisible to it.
`dependencyUpdates` still
resolves both tools (they live in the `spotbugs` / `jacocoAgent` /
`jacocoAnt`
configurations), which is why they were reported as outdated but never
bumped —
reported-but-never-applied, so the drift was silent and unbounded.

Declaring each tool as an explicit dependency in its own configuration
fixes this:
the plugins apply their defaults through `defaultDependencies`, so an
explicit
declaration takes precedence, and the notation is now something
`useLatestVersions` can rewrite. Verified locally — `gradle
useLatestVersions
--refresh-dependencies` produced the 4.10.3 and 0.8.15 numbers in this
PR itself,
and `gradle dependencies` confirms the configurations resolve to exactly
those
versions rather than the plugin defaults.

Depends on
[valkyrjaio/.github#149](https://github.com/valkyrjaio/.github/pull/149),
which adds `--refresh-dependencies` to the same workflows; without it
the
automation resolves stale versions from Gradle's 24-hour dynamic-version
cache.

SpotBugs 4.10.3 adds the `USO_UNSAFE_INHERITABLE_OBJECT_SYNCHRONIZATION`
detector,
which reports two genuine findings in `CancellationToken`: it
synchronizes on
`listeners`, a `protected` field on a class open for extension. A
subclass can
therefore take that monitor for unrelated work, or hold it indefinitely,
and stall
or deadlock cancellation (SEI CERT LCK00-J). Synchronizing on a
dedicated
`private final Object lock` resolves it with no vis... (continued)

1912 of 1914 branches covered (99.9%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

6962 of 6962 relevant lines covered (100.0%)

4.34 hits per line